The Glue of Authentication: Why authentik Is Hot Again in the AI Era
Every AI application faces the same question: how do you manage API keys?
Give 10 team members individual OpenAI keys, and you have to revoke them when someone leaves, manage different permission levels, and tier access. Connect 5 AI services (OpenAI, Anthropic, DeepSeek, Tongyi, Zhipu), each with its own auth logic. Then integrate 20 internal tools, each needing to know "who is this user and what can they do?"
These needs combined are exactly what an identity provider (IdP) solves.
goauthentik/authentik is an open-source IdP supporting the full protocol suite — SAML, OAuth2/OIDC, LDAP, RADIUS, SCIM — and can be self-hosted on your own servers. It isn't new (open-sourced since 2020), but it recently climbed GitHub Trending again, and there are structural reasons behind it.
The Problem: Identity Fragmentation in the AI Era
Before the AI application boom, identity management was relatively simple: employees logging into intranets, SaaS SSO, API access control. Solutions like Okta, Auth0, and Entra ID were sufficient.
After the AI boom, complexity jumped a level:
First, service-to-service authentication exploded. An AI Agent might call 5 external APIs, each requiring authentication. The traditional approach — a long-lived key per service — carries high leak risk and painful rotation costs.
Second, fine-grained permissions for multi-tenant AI apps. Suppose you build an AI coding assistant: Team A uses GPT-4, Team B uses DeepSeek, and individuals have different quotas. These policies need centralized management, not scattered everywhere.
Third, rising compliance demands. GDPR, SOC 2, and China's MLPS (等保) 2.0 all require complete audit logs of "who accessed what data and when." Scattered API keys can't satisfy this.
These three trends together turn a "self-hosted IdP" from optional to essential.
authentik's Positioning: Authentication Glue
authentik calls itself the "authentication glue you need" — and the metaphor is precise:
Glue isn't a building material; it's a connector. authentik doesn't replace your application, your model, or your database. It transfers "who you are" from one place to another — from corporate AD to AI apps, from Google Workspace to internal tools, from a SAML IdP to OAuth2 clients.
Glue must bond many materials. Its protocol support shows the range:
| Protocol | Typical use case | |------|---------| | SAML 2.0 | Enterprise SSO, legacy apps | | OAuth 2.0 / OIDC | Modern web apps, API auth | | LDAP | Infrastructure components (Jenkins, Grafana) | | RADIUS | Network devices, VPN | | SCIM | User lifecycle automation |
An AI startup might simultaneously need SAML for enterprise customers (who demand SSO), OIDC for its own apps, LDAP for internal tools, and SCIM to sync users into SaaS. authentik covers all of these with one system.
The value of glue is eliminating N×M integrations. Without authentik, N applications and M protocols mean N×M integrations. With it, you do N+M — each app connects to authentik, each protocol connects to authentik. That's glue math.
Why Self-Host
Okta, Auth0, and Entra ID are all cloud-hosted. Why self-host?
1. Data sovereignty. Identity data is among the most sensitive. A cloud IdP means your user directory, access policies, and audit logs live with a third party — unacceptable for finance, healthcare, and government.
2. Predictable cost. Cloud IdPs charge per monthly active user; a 1,000-person team might pay $50,000–100,000 a year for Okta. authentik runs on a $50/month VPS.
3. Customizability. authentik uses Python for policies — define arbitrarily complex auth flows in code. Cloud IdP policy engines are limited DSLs; special needs require workarounds.
4. AI-era specifics. AI apps frequently need short-lived service-to-service tokens, issued and revoked far more often than human logins. Self-hosted IdPs handle high-frequency token operations, while cloud IdPs often bill per API call — costs explode at high frequency.
Technical Architecture: Python + Go + PostgreSQL
authentik's stack is interesting:
- Core services: Python (Django)
- Frontend: TypeScript + Web Components
- Database: PostgreSQL
- Message queue / cache: Redis
- Deployment: Docker Compose / Kubernetes
- AI application teams: need customer-facing SSO, multi-service API key management, audit logs
- Self-hosting enthusiasts: already run Nextcloud, Gitea, Jellyfin, and want an IdP to tie them together
- Enterprise IT: need a self-hosted Okta alternative on a budget
- Compliance scenarios: need full audit logs and data sovereignty
- Smaller community than Keycloak: fewer Stack Overflow answers for obscure issues
- Enterprise features are paid: some advanced capabilities (like multi-tenant isolation) require the commercial edition
- Python performance ceiling: high-concurrency deployments need caching and horizontal scaling
- Learning curve: simpler than Keycloak, but IdP concepts themselves are non-trivial (SAML metadata exchange, OIDC PKCE flows, etc.)
Python for the core means programmable policies — write auth flows directly in Python, no DSL to learn. The tradeoff is performance versus Go, so authentik wrote high-performance components (like the RADIUS server) in Go while keeping business logic in Python — a pragmatic split.
Comparison with Keycloak
authentik isn't the only open-source IdP; the best-known rival is Keycloak (maintained by Red Hat).
| Dimension | authentik | Keycloak | |------|-----------|----------| | Language | Python | Java | | Deployment complexity | Low (one command via Docker Compose) | Medium (JVM tuning) | | Policy programmability | Python code | JS policies | | UI modernity | High (Web Components) | Medium (traditional) | | Community size | Smaller but active | Large and mature | | Enterprise support | Commercial edition | Red Hat support |
authentik's differentiation is Python policies + a modern frontend. For AI startups, Python policies mean you could even use ML models for auth decisions (e.g., detecting anomalous logins from behavior patterns) — something Keycloak's JS policies can't easily do.
Who Should Use It
Limitations
Closing
authentik's resurgence isn't accidental. The AI application boom brought exponential growth in identity management demands — more services to authenticate, finer permissions to manage, stricter compliance to satisfy. Against this backdrop, cloud IdP costs and inflexibility became bottlenecks.
authentik's "glue" positioning is spot-on: it doesn't try to replace your applications or models — it only moves the information of "who you are." A protocol-complete, self-hostable IdP with programmable policies is infrastructure-grade in the AI era.
The value of glue isn't in itself — it's in how many building materials it lets work together.
---
GitHub: https://github.com/goauthentik/authentik Website: https://goauthentik.io Docs: https://docs.goauthentik.io